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CROSS REFERENCE TO RELATED APPLICATIONS 

[0001] The instant application claims priority from provisional application number 

60/456,852 (Attorney Docket No. 03-4007PRO1), filed March 21, 2003, the disclosure of which 

is incorporated by reference herein in its entirety. 

[0002] The present application is a continuation-in-part of U.S. Application No. 10/271,103 
(Attorney Docket No. 02-401 1), entitled "Systems and Methods for Framing Quantum 
Cryptographic Links" and filed October 15, 2002, the disclosure of which is incorporated by 
reference herein in its entirety. 

RELATED APPLICATIONS 

[0003] The instant application is related to co-pending Application No. 

(Attorney Docket No. 02-4085), entitled "Systems and Methods for Implementing Training 
Frames for Quantum Cryptographic Links" and filed on a same date herewith, the disclosure of 
which is incorporated by reference herein in its entirety. 

[0004] The present application further relates to co-pending U.S. Patent Application No. 
09/943,709 (Attorney Docket No. 01-4015), entitled "Systems and Methods for Path Set-up in a 
Quantum Key Distribution Network" and filed August 31, 2001; and U.S. Patent Application 
No. 09/944,328 (Attorney Docket No. 00-4069), entitled "Quantum Cryptographic Key 
Distribution Networks with Untrusted Switches" and filed August 31, 2001, the disclosures of 
which are incorporated by reference herein. 
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GOVERNMENT CONTRACT 
[0005] The U.S. Government has a paid-up license in this invention and the right in limited 
circumstances to require the patent owner to license others on reasonable terms as provided for 
by the terms of Contract No. F30602-01-C-0170, awarded by the Defense Advanced Research 
Project Agency (DARPA). 

FIELD OF THE INVENTION 
[0006] The present invention relates generally to cryptographic systems and, more 
particularly, to systems and methods for implementing training frames for quantum 
cryptographic links. 

BACKGROUND OF THE INVENTION 
[0007] Within the field of cryptography, it is well recognized that the strength of any 
cryptographic system depends, among other things, on the key distribution technique employed. 
For conventional encryption to be effective, such as a symmetric key system, two 
communicating parties must share the same key and that key must be protected from access by 
others. The key must, therefore, be distributed to each of the parties. FIG. 1 shows one form of 
a conventional key distribution process. As shown in FIG. 1, for a party, Bob, to decrypt 
ciphertext encrypted by a party, Alice, Alice or a third party must share a copy of the key with 
Bob. This distribution process can be implemented in a number of conventional ways including 
the following: 1) Alice can select a key and physically deliver the key to Bob; 2) a third party 
can select a key and physically deliver the key to Bob; 3) if Alice and Bob both have an 
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encrypted connection to a third party, the third party can deliver a key on the encrypted links to 
Alice and Bob; 4) if Alice and Bob have previously used an old key, Alice can transmit a new 
key to Bob by encrypting the new key with the old; and 5) Alice and Bob may agree on a shared 
key via a one-way mathematical algorithm, such as Diffie-Helman key agreement. All of these 
distribution methods are vulnerable to interception of the distributed key by an eavesdropper 
Eve, or by Eve "cracking" the supposedly one-way algorithm. Eve can eavesdrop and intercept 
or copy a distributed key and then subsequently decrypt any intercepted ciphertext that is sent 
between Bob and Alice. In conventional cryptographic systems, this eavesdropping may go 
undetected, with the result being that any ciphertext sent between Bob and Alice is 
compromised. 

[0008] To combat these inherent deficiencies in the key distribution process, researchers 
have developed a key distribution technique called quantum cryptography. Quantum 
cryptography employs quantum systems and applicable fundamental principles of physics to 
ensure the security of distributed keys. Heisenberg's uncertainty principle mandates that any 
attempt to observe the state of a quantum system will necessarily induce a change in the state of 
the quantum system. Thus, when very low levels of matter or energy, such as individual 
photons, are used to distribute keys, the techniques of quantum cryptography permit the key 
distributor and receiver to determine whether any eavesdropping has occurred during the key 
distribution. Quantum cryptography, therefore, prevents an eavesdropper, like Eve, from 
copying or intercepting a key that has been distributed from Alice to Bob without a significant 
probability of Bob's or Alice's discovery of the eavesdropping. 
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[0009] A well known quantum key distribution (QKD) scheme involves a quantum channel, 
through which Alice and Bob send keys using polarized or phase encoded photons, and a public 
channel, through which Alice and Bob send ordinary messages. Since these polarized or phase 
encoded photons are employed for QKD, they are often termed QKD photons. The quantum 
channel is a path, such as through air or an optical fiber, that attempts to minimize the QKD 
photons' interaction with the environment. The public channel may comprise a channel on any 
type of communication network such as a Public Switched Telephone network, the Internet, or a 
wireless network. An eavesdropper, Eve, may attempt to measure the photons on the quantum 
channel. Such eavesdropping, however, will induce a measurable disturbance in the photons in 
accordance with the Heisenberg uncertainty principle. Alice and Bob use the public channel to 
discuss and compare the photons sent through the quantum channel. If, through their discussion 
and comparison, they determine that there is no evidence of eavesdropping, then the key material 
distributed via the quantum channel can be considered completely secret. 
[0010] FIGS. 2 and 3 illustrate a well-known scheme 200 for quantum key distribution in 
which the polarization of each photon is used for encoding cryptographic values. To begin the 
quantum key distribution process, Alice generates random bit values and bases 205 and then 
encodes the bits as polarization states (e.g., 0°, 45°, 90°, 135°) in sequences of photons sent via 
the quantum channel 210 (see row 1 of FIG. 3). Alice does not tell anyone the polarization of 
the photons she has transmitted. Bob receives the photons and measures their polarization along 
either a rectilinear or diagonal basis that is randomly selected with substantially equal 
probability. Bob records his chosen basis (see row 2 of FIG. 3) and his measurement results (see 
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row 3 of FIG. 3). Bob and Alice discuss 215, via the public channel 220, which basis he has 
chosen to measure each photon. Bob, however, does not inform Alice of the result of his 
measurements. Alice tells Bob, via the public channel, whether he has made the measurement 
along the correct basis (see row 4 of FIG. 3). In a process called "sifting" 225, both Alice and 
Bob then discard all cases in which Bob has made the measurement along the wrong basis and 
keep only the ones in which Bob has made the measurement along the correct basis (see row 5 of 
FIG. 3). 

[0011] Alice and Bob then estimate 230 whether Eve has eavesdropped upon the key 
distribution. To do this, Alice and Bob must agree upon a maximum tolerable error rate. Errors 
can occur due to the intrinsic noise of the quantum channel and eavesdropping attack by a third 
party. Alice and Bob choose randomly a subset of photons m from the sequence of photons that 
have been transmitted and measured on the same basis. For each of the m photons, Bob 
announces publicly his measurement result. Alice informs Bob whether his result is the same as 
what she had originally sent. They both then compute the error rate of the m photons and, since 
the measurement results of the m photons have been discussed publicly, the polarization data of 
the m photons are discarded. If the computed error rate is higher than the agreed upon tolerable 
error rate (typically no more than about 15%), Alice and Bob infer that substantial eavesdropping 
has occurred. They then discard the current polarization data and start over with a new sequence 
of photons. If the error rate is acceptably small, Alice and Bob adopt the remaining 
polarizations, or some algebraic combination of their values, as secret bits of a shared secret key 
235, interpreting horizontal or 45 degree polarized photons as binary 0's and vertical or 135 

-5- 



EXPRESS MAIL NO. ER245858942 PATENT 

Attorney Docket No. 03-4007 

degree photons as binary l's (see row 6 of FIG. 3). 

[0012] Alice and Bob may also implement an additional privacy amplification process 240 
that reduces the key to a small set of derived bits to reduce Eve's knowledge of the key. If, 
subsequent to discussion 215 and sifting 225, Alice and Bob adopt n bits as secret bits, the n bits 
can be compressed using, for example, a hash function. Alice and Bob agree upon a publicly 
chosen hash function /and take K=J{n bits) as the shared r-bit length key K. The hash function 
randomly redistributes the n bits such that a small change in bits produces a large change in the 
hash value. Thus, even if Eve determines a number of bits of the transmitted key through 
eavesdropping, and also knows the hash function /, she still will be left with very little 
knowledge regarding the content of the hashed r-bit key K. Alice and Bob may further 
authenticate the public channel transmissions to prevent a "man-in-the-middle" attack in which 
Eve masquerades as either Bob or Alice. 

SUMMARY OF THE INVENTION 
[0013] Systems and methods consistent with the present invention implement path length 
control in a quantum cryptographic system to mitigate the effects of thermal and stress 
fluctuations in the transmitter or receiver that may adversely affect the transmission of QKD 
symbols across a phase-encoded QKD link. In a process equivalent to the above polarization- 
encoding method, the key bits in the present invention may be encoded in the phase of a photon. 
A transmitter (Alice) may send single photons by means of a highly attenuated laser, with each 
photon passing through a phase adjusting element, such as, for example, a Mach-Zehnder 
interferometer, that may be randomly modulated to one of four phases using a phase adjuster to 
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encode both a value and a basis in the photon's phase 4>v a + ^Ba - Since Alice's interferometer 
may be unbalanced, two time-spaced wavepackets emerge at Alice's output when the 
interferometer is pulsed. The receiver (Bob) may contain another Mach-Zehnder interferometer, 
randomly modulated to one of two basis phases 4> B b in order to encode a basis. 
[0014] Ideally, the differential delay in both Bob's and Alice's interferometer is identical to 
within a few wavelengths and stable to within a fraction of the QKD photon's wavelength. When 
the two pulses from Alice enter Bob's interferometer, they are split into two sets of two that 
combine at the output such that the leading pulse of one set overlaps the trailing pulse of the 
other set. Interference in the overlapping wave functions creates a central pulse whose 
probability of striking either detector is dependent on the relative phases of the two waves, set by 
the total phase shift introduced at Alice and Bob,, <£ 0 = <3>va + ^Ba - ^>Bb- When the total phase 
shift is <I>o = 0, for example, the intensity is maximum at a first receiving photodetector DO at 
Bob and minimum at a second receiving photodetector Dl at Bob. A single photon is more 
likely to strike detector DO, representing a received value of zero. When the total phase shift is 
Oo = 71, the reverse is true: the photon is more likely to strike Dl, which represents a received 
value of one. 

[0015] For the link to operate properly the differential delay caused by the short and long 

arms of each interferometer should be the same and remain stable to within a fraction of the 

QKD wavelength. This state is difficult to maintain over long periods of time, since the 

interferometers may be separated by considerable distance and, thus, subject to different 

environmental conditions. Environmentally-induced changes in differential delay contribute to 
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the applied phase shift, <& 0 , and result in a higher quantum bit error rate (QBER) and disruption 
of the operation of the quantum link. The total phase shift is therefore <J> = <1> 0 + A<I>, where A<D> is 
an extraneous phase shift. 

[0016] Systems and methods consistent with the present invention employ a feedback 
system, that uses training symbols as an input, for continuously and automatically controlling the 
path length through a QKD link in order to match the interferometer at the transmitter (Alice) 
precisely with the interferometer at the receiver (Bob) in the presence of site-specific thermal and 
acoustic fiber-length fluctuations. Systems and methods consistent with the invention, thus, 
reduce QBER and ensure the proper operation of the QKD link. 

[0017] In accordance with the purpose of the invention as embodied and broadly described 
herein, a method of controlling path length in a quantum cryptographic key distribution (QKD) 
system includes receiving training symbols transmitted from a QKD transmitter over a QKD 
path. The method further includes controlling a length of the QKD path based on the received 
training symbols. 

[0018] In another implementation consistent with the present invention, a method of 
automatically controlling a path length in a quantum cryptographic key distribution system is 
provided, where the path includes a first interferometer and a second interferometer. The method 
includes employing a phase shifting element in the second interferometer. The method further 
includes automatically adjusting the phase shifting element to control the path length based on 
symbols transmitted over the path. 

[0019] In a further implementation consistent with the present invention, a method of 
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automatically controlling a path length in a quantum cryptographic key distribution (QKD) 
system is provided. The method includes employing a feedback system in the QKD system. The 
method further includes automatically controlling the path length, using the feedback system, 
based on symbols transmitted over the path. 

[0020] In yet another implementation consistent with the present invention, a method of 
controlling a path length in a quantum cryptographic key distribution (QKD) system is provided. 
The method includes determining probabilities associated with multiple detection events, the 
plurality of detection events being associated with a sequence of symbols received over a path in 
the QKD system. The method further includes controlling a length of the path based on the 
determined probabilities. 

BRIEF DESCRIPTION OF THE DRAWINGS 
[0021] The accompanying drawings, which are incorporated in and constitute a part of this 
specification, illustrate exemplary embodiments of the invention and, together with the 
description, explain the invention. In the drawings, 

[0022] FIG. 1 illustrates conventional cryptographic key distribution and ciphertext 
communication; 

[0023] FIG. 2 illustrates a conventional quantum cryptographic key distribution (QKD) 
process; 

[0024] FIG. 3 illustrates conventional quantum cryptographic sifting and error correction; 
[0025] FIG. 4 illustrates an exemplary network in which systems and methods, consistent 
with the present invention, may be implemented; 
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[0026] FIG. 5 illustrates an exemplary configuration of a QKD endpoint of FIG. 4 consistent 
with the present invention; 

[0027] FIG. 6 illustrates exemplary components of the quantum cryptographic transceiver of 
FIG. 5 consistent with the present invention; 

[0028] FIG. 7 illustrates exemplary components of the QKD transmitter of FIG. 6 consistent 
with the present invention; 

[0029] FIG. 8 illustrates exemplary components of the QKD receiver of FIG. 6 consistent 
with the present invention; 

[0030] FIG. 9 is a diagram illustrating exemplary relationships between bright and dim 
pulses and framing at the QKD transmitter and receiver; 

[0031] FIGS. 10A - 10C are diagrams that illustrate exemplary symbols used to encode 
QKD framing information consistent with the present invention; 

[0032] FIG. 1 1 is a diagram illustrating an exemplary frame structure consistent with the 
present invention; 

[0033] FIG. 12 is a diagram illustrating an exemplary sequence of data frames and training 
frames consistent with the present invention; 

[0034] FIG. 13 is a diagram of an exemplary training event binned count table consistent 
with the present invention; 

[0035] FIG. 14 is a diagram of an exemplary joint probability table consistent with the 
present invention; 

[0036] FIG. 15 is an exemplary QKD path length diagram consistent with the present 
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invention; 

[0037] FIG. 16 is a diagram of an exemplary path length control feedback system consistent 
with the present invention; 

[0038] FIGS. 17-20 are flow charts that illustrate an exemplary QKD frame transmission 
process consistent with the present invention; and 

[0039] FIGS. 21-26 are flow charts that illustrate an exemplary QKD frame reception and 
path length control process consistent with the present invention. 

DETAILED DESCRIPTION 
[0040] The following detailed description of the invention refers to the accompanying 
drawings. The same reference numbers in different drawings identify the same or similar 
elements. Also, the following detailed description does not limit the invention. Instead, the 
scope of the invention is defined by the appended claims. 

[0041] Systems and methods consistent with the present invention employ a feedback 
system, that uses training symbols as an input, for continuously and automatically controlling the 
path length through a QKD link. Control of the path through the QKD link permits the 
differential delay path-length of the interferometer at the transmitter (Alice) to be matched with 
the differential delay path-length of the interferometer at the receiver (Bob) in the presence of 
site-specific environmental differences. By controlling the path length, systems and methods 
consistent with the invention reduce QBER and ensure the proper operation of the link. 

EXEMPLARY NETWORK 
[0042] FIG. 4 illustrates an exemplary network 400 in which systems and methods, 
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consistent with the present invention, that distribute encryption keys via quantum cryptographic 
mechanisms can be implemented. Network 400 may include QKD endpoints 405a and 405b 
connected via a network 410 and an optical link/network 415. QKD endpoints 405a and 405b 
may each include a host or a server. QKD endpoints 405a and 405b may further connect to local 
area networks (LANs) 420 or 425. LANs 420 and 425 may further connect with hosts 430a - 
430c and 435a - 435c, respectively. Network 410 can include one or more networks of any type, 
including a Public Land Mobile Network (PLMN), Public Switched Telephone Network 
(PSTN), LAN, metropolitan area network (MAN), wide area network (WAN), Internet, or 
Intranet. Network 410 may also include a dedicated fiber link or a dedicated freespace optical or 
radio link. The one or more PLMNs may further include packet-switched sub-networks, such as, 
for example, General Packet Radio Service (GPRS), Cellular Digital Packet Data (CDPD), and 
Mobile IP sub-networks. 

[0043] Optical link/network 415 may include a link that may carry light throughout the 
electromagnetic spectrum, including light in the human visible spectrum and light beyond the 
human-visible spectrum, such as, for example, infrared or ultraviolet light. The link may 
include, for example, a conventional optical fiber. Alternatively, the link may include a free- 
space optical path, such as, for example, a path through the atmosphere or outer space, or even 
through water or other transparent media. As another alternative, the link may include a hollow 
optical fiber that may be lined with photonic band-gap material. 

[0044] Furthermore, optical link/network 415 may include a QKD network that includes one 
or more QKD switches (not shown) for distributing encryption keys between a source QKD 
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endpoint (e.g., QKD endpoint 405a) and a destination QKD endpoint (e.g., QKD endpoint 405b). 
Such a QKD network may include the QKD network described in U.S. Patent Application No. 
09/943,709 (Attorney Docket No. 01-4015), entitled "Systems and Methods for Path Set-up in a 
Quantum Key Distribution Network," and U.S. Patent Application No. 09/944,328 (Attorney 
Docket No. 00-4069), entitled "Quantum Cryptographic Key Distribution Networks with 
Untrusted Switches." 

[0045] QKD endpoints 405 may distribute Quantum Cryptographic keys via optical 
link/network 415. Subsequent to quantum key distribution via optical link/network 415, QKD 
endpoint 405a and QKD endpoint 405b may encrypt traffic using the distributed key(s) and 
transmit the traffic via network 410. 

[0046] It will be appreciated that the number of components illustrated in FIG. 4 is provided 
for explanatory purposes only. A typical network may include more or fewer components that 
are illustrated in FIG. 4. 

EXEMPLARY QKD ENDPOINT 
[0047] FIG. 5 illustrates exemplary components of a QKD endpoint 405 consistent with the 
present invention. QKD endpoint 405 may include a processing unit 505, a memory 510, an 
input device 515, an output device 520, a quantum cryptographic transceiver 525, an interface(s) 
530 and a bus 535. Processing unit 505 may perform all data processing functions for inputting, 
outputting, and processing of QKD endpoint data. Memory 510 may include Random Access 
Memory (RAM) that provides temporary working storage of data and instructions for use by 
processing unit 505 in performing processing functions. Memory 510 may additionally include 
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Read Only Memory (ROM) that provides permanent or semi-permanent storage of data and 
instructions for use by processing unit 505. Memory 510 can also include large-capacity storage 
devices, such as a magnetic and/or optical recording medium and its corresponding drive. 
[0048] Input device 515 permits entry of data into QKD endpoint 405 and may include a user 
interface (not shown). Output device 520 permits the output of data in video, audio, and/or hard 
copy format. Quantum cryptographic transceiver 525 may include mechanisms for transmitting 
and receiving encryption keys using quantum cryptographic techniques. Interface(s) 530 may 
interconnect QKD endpoint 405 with link/network 415. Bus 535 interconnects the various 
components of QKD endpoint 405 to permit the components to communicate with one another. 

EXEMPLARY QUANTUM CRYPTOGRAPHIC TRANSCEIVER 
[0049] FIG. 6 illustrates exemplary components of quantum cryptographic transceiver 525 of 
QKD endpoint 405 consistent with the present invention. Quantum cryptographic transceiver 
525 may include a QKD transmitter 605 and a QKD receiver 610. QKD transmitter 605 may 
include a photon source 615 and a phase/polarization/energy modulator 620. Photon source 615 
can include, for example, a conventional laser. Photon source 615 may produce photons 
according to instructions provided by processing unit 505. Photon source 615 may produce 
photons of light with wavelengths throughout the electromagnetic spectrum, including light in 
the human visible spectrum and light beyond the human-visible spectrum, such as, for example, 
infrared or ultraviolet light. Phase/polarization/energy modulator 620 can include, for example, 
conventional Mach-Zehnder interferometers. Phase/polarization/energy modulator 620 may 
encode outgoing photons from the photon source according to commands received from 
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processing unit 505 for transmission across an optical link, such as link 415. 
[0050] QKD receiver 610 may include a photon detector 625 and a photon evaluator 630. 
Photon detector 625 can include, for example, conventional avalanche photo detectors (APDs) or 
conventional photo-multiplier tubes (PMTs). Photon detector 625 can also include cryogenically 
cooled detectors that sense energy via changes in detector temperature or electrical resistivity as 
photons strike the detector apparatus. Photon detector 625 can detect photons received across 
the optical link. Photon evaluator 630 can include conventional circuitry for processing and 
evaluating output signals from photon detector 625 in accordance with quantum cryptographic 
techniques. 

EXEMPLARY QKD TRANSMITTER 
[0051] FIG. 7 illustrates exemplary components of QKD transmitter 605 consistent with the 
present invention. Photon source 615 of QKD transmitter 605 may include a QKD source 705 
and an optical attenuator 710. Phase modulator 620 of QKD transmitter 605 may include an 
optical coupler 715, an interferometer 720, and an optical coupler 735. QKD transmitter 605 
may further include a fiber adapter 740, a wavelength division multiplexer (WDM) 745, a bright 
source 747, a summing amp 750, a pulse generator 770, a delay unit 775, and a pulse generator 
780. As will be described below, QKD transmitter 605 may receive data from a group of first- 
in-first-out (FIFO) queues 755, 760 and 765 in memory 510. 

[0052] QKD source 705 may include a laser that produces photon pulses at, for example, a 
1550 nm wavelength. The number of photons contained in each photon pulse produced by QKD 
source 705 may be statistically distributed according to, for example, a Poisson distribution. 
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According to such a statistical distribution, a series of photon pulses emitted by QKD source 
705, when attenuated by optical attenuator 710, may include less than a threshold level of 
photons per pulse on average (e.g., less than 1 photon/pulse). Optical coupler 715 may include, 
for example, a 50/50 coupler, and may couple dim photon pulses from QKD source 705 to 
interferometer 720. Interferometer 720 may include a phase adjuster 725 and a separate 
interferometer arm 730. Interferometer 720 may, for example, include a Mach-Zehnder 
interferometer, that may be modulated to one of four phases to encode both a basis value and a 
cryptographic key symbol value in each photon's self interference. For example, a cryptographic 
key symbol of "0" or "1" may be encoded in either of two randomly selected non-orthogonal 
bases. In one implementation, the "0" key symbol can be encoded by either a phase shift of 0 
(basis 0) or %I2 (basis 1) and the "1" key symbol can be encoded by either a n phase shift (basis 
0) or a 37i/2 phase shift (basis 1). Four different basis and key symbol pairs (basis, symbol) may, 
thus, be encoded by four different phase shifts (0, nl2 , 7t, or 3n/2). This may be achieved by 
applying four different voltages to phase adjuster 725. These voltages may be applied by 
summing amp 750 which may convert a basis value B received from FIFO 755 and a 
cryptographic key value V received from FIFO 760 to one of four different voltages for inducing 
a corresponding phase shift in phase adjuster 725. 

[0053] Optical coupler 735 may include, for example, a 50/50 coupler, and may couple the 

signals from phase adjuster 725 and interferometer arm 730 to fiber adapter 740. Fiber adapter 

740 may interconnect polarization maintaining fiber from optical coupler 735 to non-polarization 

maintaining fiber coupled to WDM 745. WDM 745 may multiplex the "dim" photon pulses 
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from QKD source 705 with the "bright" photon pulses generated by bright source 747. Bright 
source 747 may include a laser that produces multi-photon pulses (e.g., "bright" pulses) at, for 
example, a 1300 nm wavelength. 

[0054] A series of trigger values T may be received from FIFO 765 for triggering pulse 
generator 770. When triggered, pulse generator 770 may send a pulse to bright source 747 for 
initiating the transmission of a bright pulse, and a pulse to delay unit 775. Delay unit 775 may 
delay the pulse from pulse generator 770 a specified delay interval before passing the pulse on to 
pulse generator 780. Upon receipt of the delayed pulse, pulse generator 780 may send an 
electrical pulse to QKD source 705 for initiating the transmission of a photon pulse that may be 
attenuated by optical attenuator 710 to produce a dim photon pulse. 

EXEMPLARY QKD RECEIVER 
[0055] FIG. 8 illustrates exemplary components of a QKD receiver 610 consistent with the 
present invention. QKD receiver 610 may include a WDM 805, a bright pulse detector 810, a 
polarization controller 815, a fiber adapter 820, an optical coupler 825, an interferometer 830, an 
optical coupler 845, a fiber adapter 850, a QKD APD 855 (labeled detector "DO"), a fiber 
adapter 860, and a QKD APD 865 (labeled detector "Dl"). QKD receiver 610 may further 
include a pulse threshold device 870, delay units 867 and 875, a pulse generator 872, a delay unit 
880, an amplifier 877, a pulse generator 885, a gain adjust amplifier 886, a pulse threshold 
device 889, and a pulse stretcher 887. Memory 510 may include multiple FIFO's 890, 892, 894 
and 896. 

[0056] WDM 805 may demultiplex optical pulses transmitted from a QKD transmitter 605 of 

-17- 



EXPRESS MAIL NO. ER245858942 



PATENT 

Attorney Docket No. 03-4007 



another QKD endpoint 405. WDM 805 may, for example, demultiplex bright pulses received at 
1300 nm wavelength to bright pulse detector 810. WDM 805 may further, for example, 
demultiplex dim pulses received at 1550 nm wavelength to polarization controller 815. 
Polarization controller 815 may adjust the polarization of incoming dim pulse photons, which 
have had their polarization altered by transit across link 415, such that the photons exhibit 
uniform polarization. Fiber adapter 820 may adapt non-polarization maintaining fiber coupled to 
polarization controller 815 to polarization maintaining fiber coupled to optical coupler 825. 
Optical coupler 825 may provide dim pulses to interferometer 830. Interferometer 830 may 
include, for example, a Mach-Zehnder interferometer and may further include a phase adjuster 
835 and a phase shifter 840. A phase shift may be randomly applied to phase adjuster 835 via 
gain adjust amplifier 886. Gain adjust amplifier 886 may receive a basis value B from FIFO 890 
indicating either a 0 - n or a 7i/2 -37i/2 phase angle. Gain adjust amplifier 886 may translate the 
basis value to an output voltage that adjusts the phase shift of phase adjuster 835 an amount 
corresponding to the output voltage. Phase shifter 840 may maintain a stable path length during 
photon transmission and reception and may maintain the identity of interferometers at QKD 
transmitter 605 and QKD receiver 610. In some implementations, for example, phase shifter 840 
may include a conventional fiber stretcher that is controlled by a voltage source (not shown) for 
adjusting the path length. In other implementations, phase shifter 840 may only include a 
conventional phase modulator controlled by a voltage source. Yet in other implementations, a 
bias voltage may be applied directly to the phase adjuster 835. 

[0057] Optical coupler 845 may couple the signals from phase adjuster 835 and phase shifter 
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840 and provide the coupled signals to QKD APD 855 via fiber adapter 850, and to QKD APD 
865 via fiber adapter 860. Fiber adapter 850 may adapt polarization maintaining fiber coupled to 
a port of optical coupler 845 to non-polarizarion maintaining fiber coupled to QKD APD 855. 
Fiber adapter 860 may adapt non-polarization maintaining fiber coupled to a port of optical 
coupler 845 to non-polarization maintaining fiber coupled to QKD APD 865. 
[0058] Bright pulse detector 810 may pass an electrical annunciator pulse, indicating receipt 
of a bright photon pulse, to pulse threshold device 870. Pulse threshold device 870 may provide 
a logic pulse for each bright pulse received at detector 810 to trigger the gating of QKD APDs 
(DO) 855 and (Dl) 865 via delay unit 880, amplifier 877 and pulse generator 885. Delay unit 
880 may delay the logic pulse trigger from pulse threshold device 870 a sufficient interval such 
that QKD APDs (DO) 855 and (Dl) 865 are gated precisely at a time a subsequent dim photon 
pulse arrives. At the receipt of a dim photon pulse at either QKD APD (DO) 855 or (Dl) 865, the 
outputs of the APDs are sampled by pulse threshold device 889. Pulse threshold device 889 
provides a pulse corresponding to each APD 855 and 865 if their sampled outputs meet a 
specified threshold value. Pulse stretcher 887 receives the corresponding pulse(s) from pulse 
threshold device 889 and converts the received pulses to a logic high symbol (i.e., a pulse is 
received) or a logic low symbol (i.e., no pulse is received). Logic high or low symbols 
corresponding to the output from QKD APD (DO) 855 may be provided to FIFO 894. Logic 
high or low symbols corresponding to the output from QKD APD (Dl) 865 may be provided to 
FIFO 896. 

[0059] Pulse threshold device 870 may further provide a logic pulse, corresponding to each 
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received bright photon pulse, as a trigger to FIFOs 890, 892, 894 and 896 via delay unit 867. 
The trigger may "clock" data in or out of each of the FIFOs. 

[0060] Pulse threshold device 870 may further provide a logic pulse, via delay unit 875, to 
trigger pulse generator 872. Pulse generator 872, responsive to a trigger pulse from pulse 
threshold device 870, may pass a framing symbol F to FIFO 892. 

EXEMPLARY QFRAME/PHOTON PULSE MAPPING 
[0061] FIG. 9 illustrates an exemplary mapping between a first Qframe 905 constructed at 
QKD transmitter 605, and a second Qframe 945 constructed at QKD receiver 610, and "bright" 
and "dim" pulses transmitted by QKD transmitter 605. Bright pulses 915 may indicate 
synchronization timing and frame boundaries (as described in more detail below with respect to 
FIG. 11). Dim pulses 925 may contain quantum cryptographic key symbols encoded via 
modulation of, for example, the phase of the dim photon pulse transmitted from QKD transmitter 
605. 

[0062] A transmitter Qframe 905 may include multiple frame locations (frame loc #1 910-1 

through frame loc # N 910-N), each of which may include a number of symbol values. A frame 

length may determine the number of frame locations in transmitter Qframe 905. The frame 

length may be fixed, or may vary with each frame. The symbols of each frame location may 

include a basis symbol B T , a first symbol SO and a second symbol SI. Basis value B T may 

indicate one of two bases. A first basis may include a phase shift of 0 or n. A second basis may 

include a phase shift of 7i/2 or 3tc/2. Symbols SO and SI may, together, indicate a quantum 

cryptographic key symbol. For example, SO and SI symbols of "01" may indicate a key symbol 
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of "0." As an additional example, SO and SI symbols of "10" may indicate a key symbol of "1." 
Basis symbol B T and each symbol SO and SI may be used to phase modulate 920 an outgoing 
"dim" pulse 925 from QKD transmitter 605. 

[0063] A receiver Qframe 945 may include multiple frame locations (frame loc #1 950-1 

through frame loc # N 950-N), each of which may include a number of symbol values. A frame 

length may determine the number of frame locations in receiver Qframe 945. The frame length 

may be fixed, or may vary with each frame. The symbols of each frame location may include a 

basis symbol B R , a first detected symbol DO 935 and a second detected symbol Dl 940. Basis 

value B R may indicate one of two bases. A first basis may include a phase shift of 0 or n. A 

second basis may include a phase shift of n/2 or 3tc/2. Basis value B R may be used to phase 

modulate 930 a received dim pulse 925. DO 935 may indicate a symbol detected at QKD APD 

(DO) 855 of QKD receiver 610. Dl 940 may indicate a symbol detected at QKD APD (Dl) 865 

of QKD receiver 610. 

EXEMPLARY BRIGHT PULSE SYMBOL ENCODING 

[0064] FIGS. 10 A - 10C illustrate exemplary bright photon pulse symbol encoding 

consistent with the present invention. As shown in FIG. 10A, a "1" symbol can be encoded by a 

rising edge of a bright photon pulse that is produced within a predetermined "beat" interval. As 

further shown in FIG. 10B, a "0" symbol can be encoded by a rising edge of a bright photon 

pulse that is delayed by at least one beat interval. Though FIG. 10B illustrates a rising edge 

delayed by one beat, the rising edge of the "0" symbol may be delayed an indeterminate period 

of time, as long as the delay is at least equal to or greater than one beat. For example, a period of 
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a microsecond or more, followed by a rising edge, may indicate a "0" symbol, where a rising 
edge within a period of time less than that may indicate a "1" symbol. FIG. 10C illustrates an 
exemplary symbol series "1011011" encoded according to the bright pulse encoding scheme 
illustrated in FIGS. 10A and 10B. 

EXEMPLARY BRIGHT PULSE FRAME STRUCTURE 
[0065] FIG. 1 1 illustrates an exemplary bright pulse frame 1 100 consistent with the present 
invention. Multiple "bright pulses" 1105 transmitted by bright source 747 of QKD source 605 
may define frame 1 100. Frame 1 100 may include an interframe mark 1 1 10, a frame header 
1 1 15, and frame payload annunciator pulses 1 120. Interframe mark 1 1 10 may include a 
specially designated sequence of bright pulses that indicates a start of a new frame. For example, 
a symbol sequence 00000000001 may indicate a start of a new frame. As an alternative 
example, a symbol sequence 1111111110 may indicate the start of a new frame. Frame header 
1115 may include a number of fields, such as, for example, a frame type 1 125, a data/training 
frame sequence number 1 130 and an optional frame length 1135. Frame type 1 125 may indicate 
whether frame 1 100 includes a data frame or a training frame (though other types of frames may 
also be used). Data/training frame sequence number 1 130 may include a number of bits that 
indicate a sequence number of frame 1 100. For example, frame number 1 130 may include 32 
bits binary encoded with frame 1 100' s frame number. Data frame and training frames may have 
independent (i.e., drawn from different numbering spaces) or dependent sequence numbers (i.e., 
drawn from identical, or related, numbering spaces). Thus, training frames may have frame 
numbers that are sequenced independently of the frame numbers for data frames. Data/training 
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frame number 1 130 may be encoded by a variety of techniques. Such encoding techniques may 
include, for example, binary encoding, Bose-Chaudhuri-Hochquenghem encoding or any type of 
error detecting and correcting encoding that is resistant to noisy or lossy channels. Optional 
frame length 1 135 may include a number of bits that indicate a frame length of frame 1 100. 
Frame length 1 135 may include, for example, 32 bits binary encoded with a length of frame 
1100. 

[0066] Frame payload annunciator pulses 1 120 may include a number of pulses that identify 
the boundaries of the payload of frame 1 100. In a fixed length frame (i.e., frame with no frame 
length 1135), frame payload annunciator pulses 1120 may include, for example, 1024 bits all set 
to "1." In a variable length frame, for example, frame payload annunciator pulses 1 120 may 
include a number of bits set to "1" as determined by frame length 1 135. 
[0067] During the bright pulses of the frame payload annunciator pulses 1 120, the "dim" 
pulses 1140 transmitted by QKD transmitter 605 can be considered to be "significant," and, thus, 
include the symbols of the frame payload (see 1 150, FIG. 1 1). During the period of the frame 
spanning the interframe mark 1 1 10, frame type 1 125, frame number 1 130 and frame length 
1135, any "dim" pulses transmitted by QKD transmitter 605 can be considered insignificant and, 
thus, ignored (see 1 145, FIG. 1 1). In the case of training frames, the "significant" symbols of the 
frame payload may include a pre-determined, repetitive sequence of symbols, or may include a 
sequence of symbols generated by an algorithm (e.g., a pseudorandom generator), the results of 
which may be keyed off the frame's frame number 1 130. 
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EXEMPLARY DATA AND TRAINING FRAME SEQUENCE 
[0068] FIG. 12 is a diagram of an exemplary sequence 1200 of transmitted data frames and 
training frames consistent with the invention. As shown, sequence 1200 may include N 
transmitted data frames 1205, followed by M transmitted training frames 1210, followed in turn 
by another N transmitted data frames 1215, and so on. Sequence 1200 is shown for illustrative 
purposes only. Sequence 1200 may include any number of training frames interspersed with any 
number of data frames. For example, sequence 1200 may be repetitive, or may be dynamically 
modified such that the number of data frames and training frames continuously varies. The 
mixture of data frames and training frames in sequence 1200 may be pre-determined, or may 
adapted to best fit the current operation or state of the link between the QKD transmitter and the 
QKD receiver. 

EXEMPLARY BINNED COUNT TABLE 
[0069] FIG. 13 is a diagram of an exemplary count table 1300 consistent with the present 
invention. Count table 1300 may store binned counts of detector "hits" corresponding to the 
basis and values associated with received "dim" photons and the basis with which the received 
"dim" photons are measured. In one implementation, count table 1300 may be stored in memory 
510 of a QKD endpoint 405. Alternatively, count table 1300 may also be stored in a database 
external to a QKD endpoint 405. 

[0070] Count table 1300 may include a field that indicates basis and value pairs 1305 
associated with symbols transmitted from another QKD endpoint 405a (referred to as "Alice"), a 
field 1310 that indicates a basis used by the receiving QKD endpoint 405b (referred to as "Bob") 
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for measuring received "dim" pulses, a theoretical total phase shift value O 0 1310 for the path 

between Alice and Bob, and binned counts of training events 1320. The binned counts of 

training events 1320 may include counts for "no hits" 1325 indicating a binned count of no 

symbols detected at either APD (DO) 855 or APD (Dl) 865 of QKD receiver 610, a "DO hit" 

1330 indicating a binned count of symbols detected only at DO APD 855, and not Dl APD 865, a 

"Dl hit" 1335 indicating a binned count of symbols detected only at Dl APD 865, and not DO 

APD 855, and "DO, Dl hits" 1340 indicating a binned count of symbols detected at both DO 

APD 855 and Dl APD 865. 

EXEMPLARY JOINT PROBABILITY TABLE 

[0071] FIG. 14 is a diagram of an exemplary joint probability table 1400 consistent with the 

present invention. Joint probability table 1400 may include the binned counts of training events 

1320 of count table 1300 normalized to the total number of training events contained in count 

table 1300. The process of receiving a phase-encoded symbol can be considered to include two 

experiments: setting the phase of the interferometers 720 and 830, and observing the detector DO 

855 and Dl 865 values. The sample space of these experiments, when considered as a whole, 

includes eight possible combinations of phase settings (e.g., two sets of 0, rc/2, n 9 and 3n/2 for 

BB84 protocol), and four combinations of detector values (DO = 0 n Dl = 0; DO = 1 n Dl = 0; 

DO = 0 n Dl = 1; and DO = 1 n Dl = 1). Defining two separate experiments, A and B, 

experiment A may include disjoint events Ao 1405, Ai 1410, A 2 1415, A 7 1420, with each 

disjoint event corresponding to the specific total phase shift in both interferometers, Oo + A4>. 

Experiment B may include four disjoint events B 0 1425, Bi 1430, B 2 1435 and B 3 1440, with 
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each disjoint event corresponding to a different combination of the detection events (i.e., neither 
detector DO 855 nor detector Dl 865 have fired (0,0), detector DO 855 only has fired (0,1), 
detector Dl 865 only has fired (1,0) and both detectors 855 and 865 have fired (1,1)). Each 
intersection of a row and column in count table 1300 may be normalized by the total number of 
events and inserted in a corresponding entry of joint probability table 1400. For example, row 1, 
column 1 of count table 1300 may be normalized and inserted into joint probability table 1400 as 
the probability of the intersection of events A 0 and event B 0 CP(A 0 n B 0 )). As another example, 
row 8, column 4 of count table 1300 may be normalized and inserted into joint probability table 
1400 as the probability of the intersection of events A 7 and B 3 . Furthermore, the sum of the joint 
probabilities in any column n of joint probability table 1400 results in the marginal probability 
P(B„) 1445, which indicates the probability of the occurrence of a particular event from 
experiment B, irrespective of the results of experiment A. Similarly, the sum of the joint 
probabilities in any row m of joint probability table 1400 results in the marginal probability 
P(A m ) 1450, which indicates the probability of the occurrence of a particular event from 
experiment A, irrespective of the results of experiment B. 

[0072] In one implementation, joint probability table 1400 may be stored in memory 510 of a 
QKD endpoint 405. Alternatively, joint probability table 1400 may also be stored in a database 
external to a QKD endpoint 405. 

EXEMPLARY PATH LENGTH DIAGRAM 
[0073] FIG. 15 illustrates an exemplary path length diagram that shows the path, that 
includes an optical fiber 1505, a photon pulse may take between a QKD source 705 of a 
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transmitting QKD endpoint 405a (i.e., Alice) before being detected by one or both of detectors 
DO 855 and Dl 865 at a receiving QKD endpoint 405b (i.e., Bob). In the exemplary phase path 
length diagram of FIG. 15, the transmitting QKD endpoint's 405a phase modulator 620 (not 
shown) includes a first interferometer 720 and the receiving QKD endpoint's 405b photon 
detector 625 (not shown) includes a second interferometer 830. Interferometer 720 includes a 
short interferometer arm of length Sa and a long interferometer arm of length La. Interferometer 
830 includes a short interferometer arm of length Sb and a long interferometer of length Lb. The 
mismatch between the arms of the first interferometer 720 may be long enough such that when 
pulsed with narrow pulses from QKD source 705, two distinct time-spaced wave packets emerge 
with a differential delay proportional to La - Sa. The differential delay in both interferometers 
720 and 830 is identical to within a few wavelengths and stable to within a fraction of the QKD 
photon's wavelength. When the two wave packets from Alice's interferometer 720 enter Bob's 
interferometer 830, they are split into two sets of two that combine at the output such that the 
leading wave packet of one set overlaps the trailing pulse of the other set. Interference in the 
overlapping wave functions creates a central pulse whose probability of striking either QKD 
APD detector 855 or 865 is dependent on the relative phases of the two waves, set by the total 
phase shift introduced at Alice and Bob, <I>o = <I>va + ^Ba - ^Bb- 

[0074] Consistent with one exemplary embodiment of the present invention that employs 

BB84 protocol, an additional phase shift may be introduced in La and Lb, thus, controlling the 

constructive or destructive interference at detectors DO 855 and Dl 865. For example, when the 

total introduced phase shift <t> 0 = 0 Va + ^vb - 3>Bb is zero, the intensity may be maximum at 
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detector DO 855 and minimum at detector Dl 865. For the total phase of 7C, the reverse is true, 
and for the total phase shift of nil and 2>nl2 the intensity of the resulting central peak may be 
equal for both of the detectors. For the protocol to operate properly, the differential delay caused 
by the short and long arms of each interferometer should be the same and remain stable to within 
a fraction of the QKD wavelength. This state is difficult to maintain over long periods of time, 
since both interferometers 720 and 830 may be in different locations (i.e., usually separated by 
ten's of kilometers) and subject to different temperature, pressure and stress conditions. 
Evironmentally-induced changes in differential delay contribute to the applied phase shift, Oo, 
and result in a higher quantum bit error rate (QBER) and disruption of the operation of the 
quantum link. The total phase shift is therefore O = O 0 + A<t>, where AO is an extraneous phase 
shift. 

[0075] In order to compensate for the phase error that results from environmentally-induced 

phase changes in the interferometers, a phase shifter may be included in the short arm of the 

interferometer 830. A phase error may be determined from statistics associated with the 

detection events given know settings of the intended photon phases. The phase error may then 

be compensated dynamically, by adjusting the phase shifter 840 to expand or contract the 

effective path length such that AO = 0. In one implementation in which phase shifter 840 

includes, for example, a fiber stretcher, the phase error may be compensated by adjusting the 

voltage of the fiber stretcher, thus, expanding or contracting the fiber length. 

[0076] In order to directly separate the extraneous phase error from the intended photon 

phase values in the detection statistics, the phase shift values applied by Alice for each qubit, Oy a 
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+ <J> Ba would have to be known. This information is not immediately available to Bob during data 
transmission, since the bit value and basis phases transmitted by Alice are completely random. 
Some of this information becomes available after the sifting of qubits, however, the variation in 
phase error is typically too rapid to allow for information from the delayed qubit sifting to be 
useful. Thus, consistent with the present invention, training frames, that include deterministic 
information about the values of <£ Va + ^Ba, may be used. Each training frame contains qubits 
encoded using deterministic value and basis pairs as agreed upon by Alice and Bob prior to 
frame transmission. While receiving qubits in training frames, Bob continues to apply random 
bases. However, since the value and basis settings at Alice are known apriori to Bob, Bob can 
recover the total phase shift 4> 0 for each qubit without public communication with Alice. Since 
the detection probability distribution function for both detectors depends on <E>o and phase error, 
the value of the phase error may, for example, be estimated by solving a set of non-linear 
equations. 

EXEMPLARY PATH LENGTH CONTROL FEEDBACK SYSTEM 

[0077] FIG. 16 illustrates an exemplary path length control feedback system 1600, consistent 

with the present invention, for compensating for inaccuracy in the estimates of the phase error 

A<E> when controlling the QKD system path length. Feedback system 1600 may include a set 

value 1605, a summation unit 1610, a gain (K) unit 1615, a discrete time integrator 1620, a 

digital-to-analog (D/A) voltage source 1625, a phase shifting element 1630, a training frame 

system 1635, and an estimation system 1640. Set value 1605 may set the nominal value of the 

induced phase error for adjusting the QKD path length. Summation unit 1610 may sum the set 
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value with the fed back output of the estimation system 1640 and provide the summed value to 
gain unit 1615. Gain 1615 may include a proportional gain value K for amplifying the output of 
the summation unit 1610. In one implementation, discrete time integrator 1620 may integrate the 
output of gain unit 1615 with a sampling time T and provide the output to D/A voltage source 
1625. D/A voltage source 1625 may convert the digital output voltage from integrator 1620 to 
an analog voltage level that can be applied to phase shifter 840. Phase shifter 840 may include, 
in one implementation, a fiber stretcher that may stretch or contract the system path length 
according to the voltage applied by voltage source 1625. Training frame system 1635 may 
model the training frame processing process in which the contents of training frames are counted 
in counted table 1300, and then normalized as probabilities in joint probability table 1400. 
Estimation system 1640 may model the process for estimating the total path length phase error 
AO using the probabilities tabulated in joint probability table 1400 (see FIGS. 25-26 below). In 
one implementation, for example, estimation system 1640 may employ a conventional least 
squares estimation technique for estimating the phase error AO. The phase error AO estimated 
by estimation system 1640 may be fed back to summation unit 1610 to, in combination with 
discrete-time integrator 1620 and gain unit 1615, close the loop and set the steady error of 
feedback system 1600 to zero. 

[0078] The stability of feedback system 1600 may depend on the sum of the sample time T 

and the computational delay, as well as the proportional gain K. The higher the gain, the faster 

the system 1600 will respond to change in phase error AO (the overshoot would be higher and 

the rise time would be the smallest). However, as the gain K is increased, the settling time will 
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become longer due to the ringing of the phase error A<E>, up to the point of instability. Choosing 
the right sampling time Tis important as well. 

[0079] The estimation of AO may be based on joint probability table 1400, and the more 
counts that are present in the table, the closer the probability of detection events converges to its 
mean for each point and, thus, the error of the estimate becomes smaller. However, as T 
becomes significantly large, the value of the phase error AO starts to change during the counts. 
This can be compensated by: a) increasing the number of training frames, or b) isolating both 
interferometers better (i.e., setting the time constant for the interferometer setup large). The 
plant of the system, which consists of the phase shifter, the training frames susbsystem, and the 
estimator may be essentially a linear system. It is characterized by the proportional gain of the 
phase shifter and sampling dynamics that arise from the delay required to collect data and 
compute the estimates. 

EXEMPLARY QUANTUM CRYPTOGRAPHIC 
FRAME TRANSMISSION PROCESS 

[0080] FIGS. 17-20 are flowcharts that illustrate an exemplary process, consistent with the 

present invention, for framing and transmitting cryptographic symbols over a quantum 

cryptographic link. As one skilled in the art will appreciate, the method exemplified by FIGS. 

17-20 can be implemented as a sequence of instructions and stored in memory 510 of QKD 

endpoint 405 for execution by processing unit 505. Though the exemplary process of FIGS. 17- 

20 is illustrated as an iterative loop, the process may be stopped, in some implementations, upon 

transceiver power-down, by way of user control, etc. 
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[0081] The exemplary process may begin with the setting of frame number 1 130 to an initial 
value [act 1705](FIG. 17). In some exemplary embodiments, for example, the frame number 
1 130 can be set to zero. Bright source 747 of QKD transmitter 605 may then transmit symbols 
that indicate interframe mark 1110 [act 1710]. For example, bright source 747 may transmit the 
symbols "0000000001" or some other group of symbols to indicate a start of the frame. A frame 
type 1125 may then be selected [act 1715]. The selected frame type 1125 may include, for 
example, a data frame or a training frame. Bright source 747 of QKD transmitter 605 may then 
transmit symbols that indicate the selected frame type 1 125 [act 1720]. Bright source 747 of 
QKD transmitter 605 may further transmit symbols that indicate frame number 1 130 [act 1725]. 
For example, bright source 747 may transmit 32 symbols that include an encoded frame number. 
The frame number may be encoded using binary encoding, BCH encoding, or any type of error 
detecting and correcting encoding. 

[0082] A determination may be made whether frame type 1 125 indicates that the frame is a 
training frame [act 1730]. If frame type 1 125 indicates that the frame is a data frame, and not a 
training frame, then bright source 747 may, optionally, transmit symbols that indicate frame 
length 1135 [act 1735]. For example, bright source 747 may transmit 32 symbols that include a 
binary encoded frame length value. Bright source 747 may then transmit a single frame payload 
annunciator pulse 1 120 [act 1805](FIG. 18). This annuniciator pulse may be used for 
synchronization timing and for setting a frame boundary (e.g., the first annunciator pulse) for the 
transmitted payload symbols. A basis value B T may be randomly chosen by, for example, 
processing unit 505 [act 1810]. The basis value Bt may indicate whether a cryptographic key 
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symbol will be encoded in a "dim" photon pulse by phase shifting the pulse along a 0 - n basis or 
a 7i/2 - 3n/2 basis. Processing unit 505 may retrieve a cryptographic key symbol [act 1815]. The 
key symbol may be previously generated according to any conventional encryption key 
generation algorithm and stored in memory 510. Processing unit 505 may then encode the 
retrieved key symbol as two symbols SO and SI [act 1820]. Thus, a "0" key symbol may be 
encoded as the symbols "01" and a "1" key symbol may be encoded as the symbols "10." Phase 
adjuster 725 may phase modulate an output dim pulse from QKD source 705 using basis value 
B T and one of the encoded symbol values SO and SI retrieved from FIFOs 760 and 755 [act 
1825]. For example, if transmitting SO equal to 0, and the basis value B T has been chosen as 
zero, then the outgoing dim pulse can be encoded with a phase shift of 0. As another example, if 
transmitting SO equal to 1, and the basis value B T has been chosen as zero, then the outgoing dim 
pulse can be encoded with a phase shift of n. QKD source 705 may transmit, via optical 
attenuator 710, the phase encoded dim photon pulse a specified interval after transmission of the 
frame payload annunciator pulse [act 1830], 

[0083] Processing unit 505 may determine whether the transmitted frame payload 

annunciator pulse was the last annunciator pulse of frame payload annunciator pulses 1120 [act 

1835]. If not, the exemplary process may return to act 1805 with the transmission of the next 

frame payload annunciator pulse. If the transmitted frame payload annunciator pulse was the last 

pulse of the frame, then processing unit 505 may increment frame number 1 130 [act 1840] and 

the exemplary process may return to act 1710 above to begin transmission of the next frame. 

[0084] Returning to act 1730, if processing unit 505 determines that frame type 1 125 
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indicates that the frame is a training frame, then one of a number of different training frame 
transmission processes may be implemented. In a first exemplary training frame transmission 
process, described with respect to acts 1905 - 1950 of FIG. 19, a known sequence of basis and 
value pairs (known at both the transmitting and receiving QKD endpoints) may be used to 
transmit dim pulses encoded with training symbols. In a second exemplary training frame 
transmission process, described with respect to acts 2005 - 2050 of FIG. 20, a sequence of basis 
and value pairs may be produced using a current frame number as a seed to an algorithm that 
generates the sequence. 

[0085] In the first exemplary training frame transmission process, a counter i is set to "1" 
[act 1905]. A known sequence of basis (B,) and value (V,-) pairs is selected [act 1910]. For 
example, a repetitive sequence of the following basis and value pairs may be selected: {(0,0), 
(0,1), (1,0), (1,1)}. In other embodiments, a more complex sequence of basis and value pairs 
may be selected, such as, for example, a series of all possible permutations of 4-qubit sequences 
that may exercise unusual cases in a receiving detector's behavior, such as detection probabilities 
that vary depending on recent history of activity. Furthermore, a known sequence of basis (Bi) 
and value (V/) pairs may be associated with each different training frame. A first training frame 
may have a first known associated sequence Si, a second training frame may have a second 
known associated sequence S 2 , and so on. Processing unit 505 may then, optionally, set frame 
length 1135 to a length n of the known sequence associated with the current frame and transmit 
the frame length via bright source 747 [act 1915]. For example, bright source 747 may transmit 
32 symbols that include a binary encoded frame length value. Processing unit 505 may then 
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encode symbol value V, as two symbols SO, and SI, [act 1920]. Thus, a "0" training symbol may 
be encoded as the symbols "01" and a "1" training symbol may be encoded as the symbols "10." 
Bright source 747 may then transmit a single frame payload annunciator pulse 1120 [act 1925]. 
This annuniciator pulse may be used for synchronization timing and for setting a frame boundary 
(e.g., the first annunciator pulse) for the transmitted payload symbols. 

[0086] Phase adjuster 725 may phase modulate an output dim pulse from QKD source 705 
using basis value B, and the encoded symbol values SO, and SI, [act 1930]. For example, if 
transmitting SO equal to 0, and the basis value B,- is zero, then the outgoing dim pulse can be 
encoded with a phase shift of 0. As another example, if transmitting SO equal to 1, and the basis 
value B, is zero, then the outgoing dim pulse can be encoded with a phase shift of n. QKD 
source 705 may transmit, via optical attenuator 710, the phase encoded dim photon pulse a 
specified interval after transmission of the frame payload annunciator pulse [act 1935]. 
Processing unit 505 may determine whether counter i is equal to the known sequence length n 
[act 1940]. If not, then counter i may be incremented (i.e., i = i + 1) [act 1945] and the 
exemplary process may return to act 1920 above for transmission of the next training dim pulse. 
If the counter i is equal to the known sequence length n, then frame number 1 130 may be 
incremented [act 1950] and the exemplary process may return to act 1710 (FIG. 17). 
[0087] In a second exemplary training frame transmission process, a counter j is set to "1" 
[act 2005]. Processing unit 505 may use the current frame number 1130 as a seed in an 
algorithm to generate a sequence of basis (B,) and value (V,) pairs [act 2010]. The algorithm 
may include a deterministic algorithm, such as a pseudo-random number generator, that 
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generates a sequence of basis and value pairs (B y , V}) from the frame number seed. The 
algorithm may further include a true random number generator that may work on a variety of 
principles, such as, for example, passage of a photon through a beam splitter, decaying 
radioactive atoms, thermal noise, etc. A true random number generator will give a less 
predictable random number generator that a pseudo-random number generator. The same 
algorithm may be employed at the transmitting QKD endpoint and the receiving QKD endpoint. 
In one implementation, for example, bases and symbol values (V) may be computed as a 
function if) of the training frame number (F N ) and the symbol number (s) within a frame in 
which a training symbol is to be transmitted: 

B =i(F N , s) 
V = /(Fn, s) 

where the function (/) represents a truly random or pseudo-random function. 

Processing unit 505 may then, optionally, set frame length 1135 to a length n of the generated 
sequence and transmit the frame length via bright source 747 [act 2015]. For example, bright 
source 747 may transmit 32 symbols that include a binary encoded frame length value. 
Processing unit 505 may then encode symbol value V, as two symbols SO/ and Sly [act 2020]. 
Thus, a "0" training symbol may be encoded as the symbols "01" and a "1" training symbol may 
be encoded as the symbols "10." Bright source 747 may then transmit a single frame payload 
annunciator pulse 1 120 [act 2025]. This annuniciator pulse may be used for synchronization 
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timing and for setting a frame boundary (e.g., the first annunciator pulse) for the transmitted 

payload symbols. Phase adjuster 725 may phase modulate an output dim pulse from QKD 

source 705 using basis value B, and the encoded symbol values SO, and Slj [act 2030]. For 

example, if transmitting SO equal to 0, and the basis value By is zero, then the outgoing dim pulse 

can be encoded with a phase shift of 0. As another example, if transmitting SO equal to 1, and 

the basis value B 7 is zero, then the outgoing dim pulse can be encoded with a phase shift of 7t. 

QKD source 705 may transmit, via optical attenuator 710, the phase encoded dim photon pulse a 

specified interval after transmission of the frame payload annunciator pulse [act 2035]. 

Processing unit 505 may determine whether counter j is equal to the known sequence length n 

[act 2040]. If not, then counter j may be incremented (i.e., j -j + 1) and the exemplary process 

may return to act 2020 above for transmission of the next training dim pulse. If the counter ; is 

equal to the known sequence length n, then frame number 1130 may be incremented and the 

exemplary process may return to act 1710 (FIG. 17). 

EXEMPLARY QUANTUM CRYPTOGRAPHIC 
FRAME RECEPTION AND PATH LENGTH CONTROL PROCESS 

[0088] FIGS. 21-26 are flowcharts that illustrate an exemplary process, consistent with the 

present invention, for receiving and interpreting frames of transmitted symbols and for 

performing path length control. As one skilled in the art will appreciate, the method exemplified 

by FIGS. 21-26 can be implemented as a sequence of instructions and stored in memory 510 of 

QKD endpoint 405 for execution by processing unit 505. Though the exemplary process of 

FIGS. 21-26 is illustrated as an iterative loop, the process may be stopped, in some 
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implementations, upon transceiver power-down, by way of user control, etc. 
[0089] The exemplary process may begin with the reception of bright pulses at QKD 
receiver 610 and the discarding of "0" symbols until a "1" symbol is received at bright pulse 
detector 810 [act 2105]. The discarded "0" symbols followed by the "1" symbol may indicate 
interframe mark 1 1 10. Following the "1" symbol, the subsequent eight symbols may be read as 
the frame type 1 125 [act 2110]. Frame type 1 125 may indicate whether the frame is a data frame 
or a training frame. The subsequent 32 symbols may then be read as frame number 1 130 [act 
2115]. The 32 symbols may, for example, include the frame number as a binary encoded value. 
In the case of noisy or lossy channels, techniques may be used in order to estimate the frame 
number 1 130 before corruption. Such techniques may include Maximum Likelihood Estimation, 
or other known techniques, applicable to recovering symbols corrupted in transit in noisy or 
lossy channels. Optionally, the symbols following the frame number 1 130 may be read as frame 
length 1135 [act 2120]. The frame length symbols of frame length 1135 may include, for 
example, 32 symbols that include the frame length encoded as a binary encoded value. 
[0090] A determination may be made whether frame type 1 125 indicates that the frame is a 
training frame [act 2125]. If not, a determination may then be made whether the next received 
bright pulse symbol, following the pulses of frame number 1 130 or optional frame length 1 135, 
equals the "1" symbol [act 2130]. If not, then the exemplary process may return to act 2105 
above. If the next bright pulse symbol equals the "1" symbol, indicating the start of the frame 
payload, then the "1" symbol may be counted by, for example, processing unit 505 [act 
2205](FIG. 22). Processing unit 605 may randomly choose a basis value B R [act 2210] and may 
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adjust phase adjuster 835, via gain adjust amplifier 886, according to the chosen basis [act 2215]. 
For example, with a chosen basis value B R of 0, phase adjuster 835 may adjust the phase of a 
received dim pulse by zero degrees. With a chosen basis value B R of 1, for example, phase 
adjuster 835 may adjust the phase of a received dim pulse by nl2 degrees. 
[0091] Dim pulse hits on both detectors (DO) 855 and (Dl) 865 may then be sampled to 
produce values DO and Dl [act 2220]. A current frame number, basis B R , values DO and Dl, 
and the dim pulse photon number corresponding to the current received dim photon pulse may be 
recorded in, for example, memory 510 [act 2225]. The dim pulse photon number may then be 
incremented [act 2230]. A determination may then be made whether the symbol count (act 2205 
above) matches the frame length [act 2235]. For example, if the frame length includes 1024 
symbols, the end of the frame will occur when the symbol count equals 1024. If the symbol 
count does not match the frame length, the exemplary process may return to act 2130 for receipt 
of the next bright annunciator pulse. If the symbol count matches the frame length, then the 
frame number, dim pulse photon number, basis B R , and DO and Dl values may be utilized in 
subsequent QKD sifting and error correction [act 2240]. QKD sifting and error correction may 
be performed, for example, according to conventional techniques. The exemplary process may 
then return to act 2105 to begin the processing of another frame. 

[0092] Returning to act 2125, if frame type 1 125 indicates that the frame is a training frame, 
then a determination may then be made whether the next received bright pulse symbol equals the 
"1" symbol [act 2305](FTG. 23). If not, then the exemplary process may return to act 2105 
above. If the next bright pulse symbol equals the "1" symbol, indicating the start of the frame 
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payload, then the "1" symbol may be counted by, for example, processing unit 505 [act 2310]. 
Processing unit 505 may randomly choose a basis value B R [act 2315] and may adjust phase 
adjuster 835, via gain adjust amplifier 886, according to the chosen basis B R [act 2320]. For 
example, with a chosen basis value B R of 0, phase adjuster 835 may adjust the phase of a 
received dim pulse by zero degrees. With a chosen basis value B R of 1, for example, phase 
adjuster 835 may adjust the phase of a received dim pulse by nil degrees. Dim pulse hits on 
both detectors DO 855 and Dl 865 may then be sampled [act 2325]. A basis and symbol value 
pair (B,V) used to transmit a received training symbol may then be deduced [act 2330]. 
Processing unit 505, for example, may deduce the basis and value pair by retrieving a 
corresponding known basis and symbol value pair from memory 510. The basis (B) and symbol 
value (V) pair may be known to both the transmitting QKD endpoint and the receiving QKD 
endpoint. As another example, processing unit 605 may deduce the basis and value pair by 
generating the basis and symbol value pair using an algorithm, such as a truly random or pseudo- 
random algorithm. In one implementation, for example, a basis and symbol value (V) may be 
generated as a function (/) of the training frame number (F N ) and the symbol number (s) within a 
frame in which a training symbol is received: 

B =/(Fn, s) 
V=/(F N , s) 

where the function (/) represents a truly random or pseudo-random function. 
The same algorithm may be employed at the transmitting QKD endpoint and the receiving QKD 

-40- 



EXPRESS MAIL NO. ER245858942 PATENT 

Attorney Docket No. 03-4007 

endpoint. 

[0093] Processing unit 505 may then use the deduced basis and symbol value pair (B, V) and 
the chosen basis B R , used to detect the training symbol (see act 2315 above), as a row index 
(INDEXrow) for count table 1300 [act 2335]. Processing unit 505 may further use detector hits 
at detectors DO 855 and Dl 865 as a column index (INDEX C olumn) for count table 1300 [act 
2340]. Processing unit 505 may then increment a running count in a table entry of count table 
1300 that corresponds to the row index and column index (INDEXrow, INDEXcolumn) [act 
2405](FIG. 24). For example, if a basis and symbol value pair of (0, 0) is deduced, a basis value 
B R of 0 is used to detect an incoming dim pulse, and no hits were detected on either of the DO 
APD 855 or Dl APD 865, then the table entry in row = 1 and column = 1 of count table 1300 
would be incremented. As another example, if a basis and symbol value pair of (1,1) is deduced, 
a basis value B R of 1 is used to detect an incoming dim pulse, and hits at both of the DO APD 
855 and the Dl APD 865 were detected, then the table entry in row = 8 and column = 4 of count 
table 1300 would be incremented. Each entry of count table 1300, thus, keeps a running count of 
how many times a particular combination of events has occurred. 

[0094] The dim pulse photon number may then be incremented [act 2410]. A determination 
may then be made whether the symbol count (see act 2310 above) matches the frame length [act 
2415]. For example, if the frame length includes 1024 symbols, the end of the frame will occur 
when the symbol count equals 1024. If the symbol count does not match the frame length, the 
exemplary process may return to act 2305 for receipt of the next bright annunciator pulse. If the 
symbol count matches the frame length, then the results stored in count table 1300 may be used 
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to perform a path length control process as described with respect to FIGS. 25-26 below. The 
results in count table 1300 may, for example, be statistically analyzed at the end of a current 
training frame, after some number of training frames, or at periodic intervals for performing the 
exemplary path length control process described with respect to FIGS. 25-26 below. 
[0095] The exemplary path length control process may begin with the normalization of 
counts in count table 1300, to the total number of events, to obtain an updated joint probability 
table 1400 [act 2505](FIG. 25). Thus, if, for example, the total number of events equals 100, 
then the counts contained in row 1 and column 1 of count table 1300 may be divided by 100 and 
the result stored in joint probability table 1400 at the intersection of event A 0 1405 and event B 0 
1425 as the probability of the intersection of event A 0 and event B 0 P(A 0 n B 0 ). As another 
example, the counts contained in row 3 and column 2 of count table 1300 may be divided by 100 
and the result stored in joint probability table 1400 at the intersection of event A 2 and event Bi as 
the probability of the intersection of event A2 and event Bi P(A 2 n Bi). 
[0096] Ignoring the case when two photons are emitted from QKD source 705, the 
probabilities of events Bi and B 2 can be modeled from the parameters of the system as follows: 

P{B X \® = O 0 + AO) = P(D0 = 1 nDl = (jo = O 0 + AO) =a< 0 > + ^(o) ! + v c os(O 0 + AO) ^ (J) 



P(B 2 \d> = O 0 + AO) = P(D0 = OnDl = l|o = O 0 + AO) + ^O) 1 Vcos(O 0 +AO) 



Eqn. (2) 
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where parameters cc(/), P0) anc * ^are offset, scale and visibility parameters of the system that do 
not depend on Oo or AO. The conditional probability p(Bj\® = O 0 + A<I>) on the left side of 
equations (1) and (2) can be determined as the ratio of the joint probabilities: 

P(Bj\A m ) = P(Bj nA m )/P(A m ) Eqn. (3) 

wherein A m is one of the disjoint events Ao. - . A7, each corresponding to the specific total phase 
shift of both interferometers, O 0 +AO. Eqns. (1) and (2), thus, produce sixteen non-linear 
equations, eight for the detection event Bi (i.e., the intersection of event Bi with events Ao 
through A 7 in joint probability table 1400) and eight for the detection event B 2 (i.e., the 
intersection of event B 2 with events A 0 through A 7 in joint probability table 1400), with five 
unknown parameters a (0) +P (0) /2, a (1) +p (1) /2, P (0) V/2, (3 (1) V/2 and AO, and one input variable O 0 . 

An estimate of AO may be obtained using conventional least squares estimation 
algorithms and Eqns. (1), (2) and (3). Convention least squares estimation may include an 
interative method that starts with an initial guess of the unknown parameters oc (0) +|5 (0) /2, 
cc (1) +P (1) /2, p (0) V/2, p (1 V/2 and AO of Eqns (1), (2) and (3). Each iteration may then adjust the 
current guess until the algorithm converges, minimizing the sum of the squared differences 
between the observed responses (i.e., normalized probabilities from joint probability table 1400) 
and their fitted values. In one implementation, a Gauss-Newton method with Levenberg- 
Marquardt modifications for global convergence may be used for performing least squares 
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estimation. One skilled in the art will recognize, however, that other techniques may be used for 
estimating A<i>, including (but not limited to), using Kalman filters or robust least squares 
estimates such as least absolute residuals or Bisquare weights. 

In order to determine the initial estimate of the unknown parameters a (0) +|3 (0) /2, 
a (i) + p(D /2) p<°>v/2, p (1) V/2 and A<D, Eqns. (1) and (2) can be generalized to the following: 



Eqn. (4) 




Eqn. (5) 



= * W + (-l)'|ros(* 0 )jc w> -an(* 0 )y a) ] 



Eqn. (6) 



where 



X U> = v/3 (j) cos(b<P)/2, 



Eqn. (7) 



y U) =v / 9°>sin(A<t>)/2, 



Eqn. (8) 



Eqn. (9) 



and 7 = 0, 1 is the index of the detection events equal to 0 for B\ and 1 for B 2 events. A least 
squares fit of Eqn. (6) may be performed, using conventional estimation techniques, to determine 
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parameters jc w and for 7= 0 and 7=1 [act 2510]. The initial estimates of the unknown 
parameters cc (0) +p (0) /2, a (1) +|5 (I) /2, p (0) V/2, p (1) V/2 and AO may then be obtained, using the 
determined parameters jc w and y w , from the following: 



AO = atan2(); 0) ,jc a) ) 



(^V/2) 2 =(x W) ) 2 +(y U) ) 2 



Eqn. (10) 
Eqn. (11) 
Eqn. (12) 



for 7=0 and 7=1. Since A<E> is a common parameter for both detectors, two initial guesses are 
available. The fit with a smaller residual is more accurate and, thus, would be a better candidate 
for the initial estimate. The initial estimates only have to be completed once. For consecutive 
estimation, the previous estimate of the parameters may be used. 

[0097] An estimation may be performed, using the initial estimates of cc (0) +P (0) /2, 

a (1) +|3 (1) /2, p<°>v/2, P (l) V/2 and AO obtained in act 2515 above, to converge upon a final estimate 
of A4> [act 2520]. The estimation may include, for example, an iterative least squares estimation 
algorithm that starts with the initial estimates of the unknown parameters oc (0) +p (0) /2, a (1) +|3 (1) /2, 
P (0) V/2, p (1) V/2 and AO and then adjusts a current guess of the unknown parameters until the 
algorithm converges, minimizing the sum of the squared differences between the observed 
responses (i.e., normalized probabilities from joint probability table 1400) and their fitted values. 
In one implementation, a Gauss-Newton method with Levenberg-Marquardt modifications for 
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global convergence may be used for performing the least squares estimation. After converging 
upon an estimate of AO, the estimate may be used to adjust the path length of the QKD system 
[act 2605]. The phase error AO may then be compensated dynamically, by employing path 
length control feedback system 1600 to adjust phase shifting element 840 to expand or contract 
the effective path length such that AO = 0. In one implementation in which phase shifting 
element 840 includes, for example, a fiber stretcher, the phase error AO may be compensated by 
employing path length control feedback system 1600 to adjust the voltage of the fiber stretcher, 
thus, expanding or contracting the fiber length. In another implementation in which phase 
shifting element 1630 includes, for example, a phase modulator, the phase error AO may be 
compensated by employing path length control feedback system 1600 to adjust the voltage of the 
phase modulator to expand or contract the fiber length. After the path length is adjusted, count 
table 1300 may be reset to zero [act 2610], and the process of count accumulation may continue. 

CONCLUSION 

[0098] Systems and methods consistent with the present invention implement path length 

control in a quantum cryptographic system to mitigate the effects of thermal and acoustic 

fluctuations that may adversely affect the transmission of QKD symbols across a QKD link. The 

path length control process, consistent with the present invention, employs a feedback system, 

that uses training symbols as an input for continuously and automatically controlling the path 

length through a QKD link. Through use of the feedback system for controlling the path length, 

QBER may be reduced and proper operation of the link may be ensured. 

[0099] The foregoing description of exemplary embodiments of the present invention 
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provides illustration and description, but is not intended to be exhaustive or to limit the invention 
to the precise form disclosed. Modifications and variations are possible in light of the above 
teachings or may be acquired from practice of the invention. For example, while certain 
components of the invention have been described as implemented in software and others in 
hardware, other configurations may be possible. Furthermore, while wavelength division 
multiplexing of the bright and dim pulses has been described above, time division multiplexing 
may be used, alternatively, or in conjunction with wavelength division multiplexing, for 
transmitting the bright and dim pulses over the quantum cryptographic link (e.g., bright pulses 
alternating with dim pulses in a time division manner). Additionally, while exemplary 
embodiments of the present invention have been described as using optical QKD pulses (i.e., 
photon pulses) for encoding and transmitting cryptographic keys, it will be appreciated that other 
non-optical pulses that include, for example, individual atoms, electrons, etc., may alternatively 
be used. In embodiments employing non-optical pulses, the individual quantum particles (e.g., 
atoms, electrons) may be modulated to encode cryptographic key symbols. 
[00100] While series of acts has been described with regard to FIGS. 17-26, the order of the 
acts may vary in other implementations consistent with the present invention. Also, non- 
dependent acts may be performed in parallel. No element, act, or instruction used in the 
description of the present application should be construed as critical or essential to the invention 
unless explicitly described as such. Also, as used herein, the article "a" is intended to include 
one or more items. Where only one item is intended, the term "one" or similar language is used. 
The scope of the invention is defined by the following claims and their equivalents. 
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